Vshantaram

A

Seminar report on

Graphical Password Authentication Survey

Towards partial fulfillment for the award of the degree

Of

B.TECH

IN

INFORMATION TECHNOLOGY

Submitted to Submitted by

Mr. Mayank Mod Janam Trivedi

HEAD (Dept. of IT)

Department of Information Technology
Pacific Institute of Technology
Udaipur (Raj)

Graphical Password Authentication Page 1

Graphical Password Authentication Survey


ABSTRACT

The most common computer authentication method is to use alphanumerical
usernames and passwords. This method has been shown to have significant drawbacks.
For example, users tend to pick passwords that can be easily guessed. On the other
hand, if a password is hard to guess, then it is often hard to remember. To address this
problem, some researchers have developed authentication methods that use pictures as
passwords. In this paper, we conduct a comprehensive survey of the existing graphical
password techniques.

We classify these techniques into two categories:
recognition-based
recall-based approaches

We discuss the strengths and limitations of each method and point out the
future research directions in this area. We also try to answer two important questions:
“Are graphical passwords as secure as text-based passwords?”; “What are the major
design and implementation issues for graphical passwords?”

This survey will be useful for information security researchers and practitioners
who are interested in finding an alternative to text-based authentication methods.


TABLE OF CONTENTS

CHAPTER TITLE PAGE
NO NO
1 INTRODUCTION 5
2 AUTHENTICATION METHODS 8
2.1 OVERVIEW OF METHODS 9
3 THE SURVEY 10
3.1 RECOGNISTION TECH. 11
3.2 RECALL TECH 17
4 CONCLUSION 20
REFERRENCE 24


CHAPTER-1

INTRODUCTION


INTRODUCTION

Human factors are often considered the weakest link in a computer security
system. Point out that there are three major areas where human- computer interaction
is important:
Authentication
Security option
Development of secure system
Here we focus on the authentication problem.

The most common computer authentication method is for a user to submit a
user name and a text password. The vulnerabilities of this method have been well
known. One of the main problems is the difficulty of remembering passwords. Studies
have shown that users tend to pick short passwords or passwords that are easy to
remember. Unfortunately, these passwords can also be easily guessed or broken.
According to a recent Computerworld news article, the security team at a large
company ran a network password cracker an d within 30 seconds, they identified about
80% of the passwords. On the other hand, passwords that are hard to guess or break are
often hard to remember. Studies showed that since user can only remember a limited
number of passwords, they tend to write them down or will use the same passwords for
different accounts.

To address the problems with traditional username- password authentication,
alternative authentication methods, such as biometrics, have been used. In this paper,
however, we will focus on another alternative: using pictures as passwords.

Graphical password schemes have been proposed as a possible alternative to
text-based schemes, motivated partially by the fact that humans can remember pictures
better than text; psychological studies supports such assumption. Pictures are generally
easier to be remembered or recognized than text. In addition, if the number of possible
pictures is sufficiently large, the possible password space of a graphical password
scheme may exceed that of text- based schemes and thus presumably offer better
resistance to dictionary attacks. Because of these (presumed) advantages, th ere is a


growing interest in graphical password. In addition to workstation and web log-in
applications, graphical passwords have also been applied to ATM machines and
mobile devices.

In this report, we conduct a comprehensive survey of the existing graphical
password techniques. We will discuss the strengths and limitations of each method and
also point out future research directions in this area. In conducting this survey, we
want to answer the following questions:
1) Are graphical passwords as secure as text password?
2) What are the major design and implementation issues for graphical passwords?

This paper will be particularly useful for researchers who are interested in
developing new graphical password algorithms as well as industry practitioners who
are interested in deploying graphical password techniques.


CHAPTER-2

AUTHENTICATION METHODS


2.1) OVERVIEW OF THE AUTHENTICATION METHODS

Current authentication methods can be divided into three main areas:

Token based authentication
Biometric based authen tication
Knowledge based authentication

Token based techniques, such as key cards, bank cards an d smart cards are
widely used. Many token-based authentication systems also use kno wledge based
techniques to enhance security. For example, ATM cards are generally used together
with a PIN number.

Biometric based authentication techniques, such as fingerprints, iris scan, or
facial recognition, are not yet widely adopted. The major drawback of this approachis
that such systems can be expensive, and the identification process can be slow and
often unreliable. However, this type of technique provides the highest level of security.

Knowledge based techniques are the most widely used authentication
techniques and include both text-based an d picture-based passwords. Th e picture-
based techniques can be further divided into two categories:
Recognition based
Recall based

Using recognition-based techniques, a user is presented with a set of images
and the user passes the authentication by recognizing and iden tifying the images he or
she selected during the registration stage. Using recall-based techniques, a user is
asked to reproduce something that h e or she created or selected earlier during the
registration stage.


CHAPTER-3
THE SURVEY


3.1) Recognition Based Techniques

Dhamija and Perrig proposed a graphical authentication scheme based on the
Hash Visualization technique. In their system, the user is asked to select a certain
number of images from a set of random pictures generated by a program (figure 1).
Later, the user will be required to identify the pre- selected images in order to be
authenticated. The results showed that 90% of all participants succeeded in the
authentication using this technique, while only70% succeeded using text-based
passwords and PINS. The average log-in time, however, is longer than the traditional
approach. A weakness of this system is that the server n eeds to store the seeds of the
portfolio images of each user in plain text. Also, the process of selecting a set of
pictures from the picture database can be tedious and time consuming for the user.

Akula and Devisetty’s algorithm is similar to the technique proposed by
Dhamija and Perrig. The difference is that by using hash function SHA-1,which
produces a 20 byte output, the authentication is secure and require less memory. The
authors suggested a possible future improvement by providing persistent storage and
this could be deployed on the Internet, cell phones and PDA's.

Figure 1.Random images used by Dhamija and Perrig


Wein shall and Kirkpatrick sketched several authentication schemes, such as
picture recognition, object recognition, and pseudo word recognition, and conducted a
n umber of user studies. In the picture recognition study, a user is trained to recognize
a large set of images (100 – 200 images) selected from a database of 20,000 images.
After one to three months, users in their study were able to recognize over 90% of the
images in the training set. This study showed th at pictures are the most effective
among the three schemes tested. Pseudo codes can also be used, but require proper
setting and training.

FIG.3 A SHOULDER
SURFING RESIST PASSWORD

Sobrado and Birget developed a graphical password technique that deals with
the shoulder- surfing problem. In the first scheme, the system will display a number of
pass-objects (pre-selected by user) among many other objects. To be authenticated, a
user needs to recognize pass-objects and click inside the convex hull formed by all the
pass-objects (figure 2). In order to make the password hard to guess, Sobrado and
Birget suggested using 1000 objects, which makes the display very crowded and the
objects almost indistinguishable, but using fewer objects may lead to a smaller
password space, since the resulting convex hull can be large. In their second algorithm,
a user moves a frame (and the objects within it) until the pass object on the frame lines
up with th e other two pass- objects. The authors also suggest repeating the process a
few more times to minimize the likelihood of a few more times to minimize the
likelihood of logging in by randomly clicking or rotating. The main drawback of these
algorithms is that the log in process can be slow.


Figure 3 Another shoulder surfing resistant scheme developed by Hong

Scientists proposed another shoulder-surfing resistant algorithm. In th is
algorithm, a user selects a number of pictures as pass-objects. Each pass-object has
several variants and each variant is assigned a unique code. During authentication, the
user is challenged with several scenes. Each scene contains several pass-objects (each
in th e form of a randomly chosen variant) and man y decoy-objects. The user has to
type in a string with the unique codes corresponding to the pass-object variants present
in the scene as well as a code indicating the relative location of the pass- objects in
reference to a pair of eyes. The argument is that it is very hard to crack this kind of
password even if the whole auth indication process s is recorded on video because
where is no mouse click to give away the pass-object in formation. However, th is
method still requires users to memorize the alphanumeric code for each pass-object
variant. Hong later extended this approach to allow the user to assign their own codes
to pass-object variants. Figure 3 shows the log-in screen of this graphical password
scheme. However, this method still forces the user to memorize many text strings and


therefore suffer from the many drawbacks of text-based passwords.

Figure 4 an example of Pass faces

“Passface” is a technique developed by Real User Corporation. The basic idea
is as follows. The user will be asked to choose four images of human faces from a face
database as th eir future password. In the authentication stage, the user sees a grid of
nine faces, consisting of one face previously chosen by the user and
eight decoy faces (figure 4). The user recognizes and clicks anywhere on
the known face. This procedure is repeated for several rounds. The user is
authenticated if he/she correctly identifies the four faces. The technique is based on the
assumption that people can recall human faces easier than other pictures. User studies
by Valentine have shown that Passfaces are very memorable over long intervals.
Comparative studies conducted by Brostoff and Sasse showed that Passfaces had only
a third of the login failure rate of text-based passwords, despite having about a third the
frequency of use.

Their study also showed that the Passface-based log– in process took longer
than text passwords and therefore was used less frequently by users. However the
effectiveness of this method is still uncertain. Davis studied the graphical passwords
created usin g the Passface technique and found obvious patterns among these
passwords. For example, most users tend to choose faces of people from the same race.
This makes the Passface password somewhat predictable. This problem may be
alleviated by arbitrarily assigning faces to users, but doing so would make it hard for


people to remember the password.

Jan sen proposed a graphical password mechanism for mobile devices. During
the enrollment stage, a user selects a theme (e.g. sea, cat, etc.) which consists of
thumbnail photos and then registers a sequence of images as a password (figure 5).
During the authentication, the user must enter th e registered images in the correct
sequence. One drawback of this technique is that since the number of thumbnail
images is limited to 30, the password space is small. Each thumbnail image is assigned
a numerical value, and the sequence of selection will generate a numerical password.
The result sh owed that the image sequence length was generally shorter than the
textural password length. To address this problem, two pictures can be combined to
compose a new alphabet element, th us expanding the image alphabet size.

Figure 5. A graphical password scheme

Takada and Koike discussed a similar graphical password technique for mobile
devices. This technique allows users to use their favorite image for authentication. The
users first register their favorite images (pass-images) with the server. During
authentication, a user has to go through several rounds of verification. At each round,


the user either selects a pass-image among several decoy-images or chooses nothing if
no pass-image is present. The program would authorize a user only if all verifications
are successful. Allowing users to register their own images makes it easier for user to
remember their pass-images. A notification mechanism is also implemented to notify
users when new images are registered in order to prevent unauthorized image
registration. This method does not necessarily make it a more secure authentication
method than text-based passwords. As shown in the studies by Davis users’ choices of
picture passwords are often predictable. Allowing users to use their own pictures
would make the password even more predictable.
3.2) Recall Based Techniques

In this section we discuss two types of picture password techniques:
reproducing a drawing and repeating a selection.
Jermyn proposed a technique, called “Draw- a - secret (DAS)”, which allows the user
to draw their unique password (figure 6). A user is asked to draw a simple picture on a
2D grid. The coordinates of the grids occupied by the picture are stored in the order of
the drawing. During authentication, the user is asked to re-draw the picture. If the
drawing touches the same grids in the same sequence, then the user is authenticated.
Jermyn, et al. suggested that given reasonable-length passwords in a 5 X 5 grid, the
full password space of DAS is larger than that of the full text password space.


Figure 6. Draw-a-Secret (DAS) technique

Thorpe and van Oorschot analyzed the memorable password space of the
graphical password scheme by Jermyn. They introduced the concept of graphical
dictionaries and studied the possibility of a brute-force attack using such dictionaries.
They defined a length parameter for the DAS type graphical passwords and showed
that DAS passwords of length 8 or larger on a 5 x 5 grid may be less susceptible to
dictionary attack than textual passwords. They also showed that the space of mirror
symmetric graphical passwords is significantly smaller than the full DAS password
space. Since people recall symmetric images better than asymmetric images, it is
expected that a significant fraction of users will choose micro symmetric passwords. If
so, then the security of the DAS scheme may be substantially lower than originally
believed. This problem can be resolved by using longer passwords. Thorpe and van
Oorschot showed that th e size of the space of mirror symmetric passwords of length
about L + 5 exceeds that of the full password space for corresponding length L <= 14
on a 5 x 5 grid.
Thorpe and van Oorschot further studied the impact of password length and
stroke-count as a complexity property of the DAS scheme. Their study showed that
stroke-count has the largest impact on the DAS password space -- The size of DAS
password space decreases significantly with fewer strokes for a fixed password length.
The length of a DAS password also has a significant impact but the impact is not as
strong as the stroke-count. To improve the security, Thorpe and van Oorschot
proposed a “Grid Selection” technique. The selection grid is an initially large, fine
grained grid from which the user selects a drawing grid a rectangular region to zoom in
on , in which they may enter their password (figure 7). This would significantly
increase the DAS password space.

Goldberg did a user study in which they used a technique called “Passdoodle”.
This is a graphical password comprised of handwritten designs or text, usually drawn
with a stylus onto a touch sensitive screen. Their study concluded that users were able
to remember complete doodle images as able to remember complete doodle images as
studies also showed that people are less likely to recall the order in which they drew a
DAS password. However, since the user study was done using a paper prototype


instead of computer programs, with verifications done by a human rather than
computer, the accuracy of this study is still uncertain.

Figure 7. Grid selection: user selects a drawing grid

Nali and Thorpe conducted further analysis of the“Draw-A-Secret (DAS)”.In
their study, users were asked to draw a DAS password on paper in order to determine
if there are predictable characteristics in the graphical passwords that people choose.
The study did not find any predictability in the start and end points for DAS password
strokes, but found that certain symmetries (e.g. crosses and rectangles), letters, and
numbers were common. This study showed that users choose graphical passwords with
predictable characteristics, particularly those proposed as "memorable". If this study is
indicative of the population, the probability in which some of these characteristics
occur would reduce the entropy of the DAS password space. However, this user study
only asked the users to draw a memorable password, but did not do any recall-test on
whether or not the passwords were really memorable.


Figure 8. A signature is drawn by mouse.

Syukri, proposes a system where authentication is conducted by having the user
drawing their signature using a mouse (figure 8). Their technique included two stages,
registration and verification. During the registration stage: the user will first be asked
to draw their signature with a mouse, and then the system will extract the signature
area and either en large or scale-down the signature, and rotates if needed, (also known
as normalizing). The information will later be saved into the database. The
verification stage first takes the user input, and does the normalization again, and
then extracts the parameters of the signature. After that, the system conducts
verification using geometric average means and a dynamic update of the database.
According to the paper the rate of successful verification was satisfying. The biggest
advantage of this approach is that there is n o need to memorize one’s signature and
signatures are hard to fake. However, not everybody is familiar with using a mouse as
a writing device; the signature can therefore be hard to draw. One possible solution to
this problem would be to use a pen-like input device, but such devices are not widely
used, and adding new hardware to the current system can be expensive. We believe
such a technique is more useful for small devices such as a PDA, which may already
have a stylus.


CHAPTER-4
CONCLUSION


Very little research has been done to study the difficulty of cracking graphical
passwords. Because graphical passwords are not widely used in practice, there is no
report on real cases of breaking graphical passwords. Here we briefly exam some of
the possible techniques for breaking graphical passwords and try to do a comparison
with text-based passwords.

Brute force search
The main defense against brute force search is to have a sufficiently large password
space. Tex t-based passwords have a password space of 94^N, where N is the length of
the password, 94 is the number of printable characters excluding SPACE. Some
graphical password techniques have been shown to provide a password space similar
to or larger than that of text-based passwords. Recognition based graphical passwords
tend to have smaller password spaces than th e recall based methods.

It is more difficult to carry out a brute force attack against graphical passwords
than text-based passwords. The attack programs need to automatically generate
accurate mouse motion to imitate human input, which is particularly difficult for recall
based graphical passwords. Overall, we believe a graphical password is less vulnerable
to brute force attacks than a text-based password.

Dictionary attacks
Since recognition based graphical passwords involve mouse in put instead of
keyboard input, it will be impractical to carry out dictionary attacks against this type of
graphical passwords. For some recall based graphical passwords, it is possible to use a
dictionary attack but an automated dictionary attack will be much more complex than a
text based dictionary attack. More research is needed in this area. Overall, we believe
graphical passwords are less vulnerable to dictionary attacks than text-based
passwords.

Guessing
Unfortunately, it seems that graphical passwords are often predictable, a serious
problem typically associated with text-based passwords. For example, studies on the


Passface technique have shown that people often choose weak and predictable
graphical password

Spyware
Except for a few exceptions, key logging or key listen in g spyware cannot be used
to break graphical passwords. It is not clear whether “mouse tracking” spyware will be
an effective tool against graphical passwords. However, mouse motion alone is not
enough to break graphical passwords. Such information has to be correlated with
application information, such as window position and size, as well as timing
information.

Shoulder surfing
Like text based passwords, most of the graphical passwords are vulnerable to
shoulder surfing. At this point, only a few recognition-based techniques are designed
to resist shoulder-surfing. None of the recall-based based techniques are considered
should-surfing resistant.

Social engineering
Comparing to text based password, it is less convenient for a user to give away
graphical passwords to another person. For example, it is very difficult to give away
graphical passwords over the phone. Setting up a phishing web site to obtain graphical
passwords would be more time consuming.

Overall, we believe it is more difficult to break graphical passwords using the
traditional attack methods like brute force search, dictionary attack, and spyware.
There is a need for more in -depth research that investigates possible attack methods
against graphical passwords.

The past decade has seen a growing interest in using graphical passwords as an
alternative to the traditional text-based passwords. In this paper, we have conducted a
comprehensive survey of existing graphical password techniques. The current


graphical password techniques can be classified into two categories: recognition-based
and recall-based techniques. Although the main argument for graphical passwords is
that people are better at memorizing graphical passwords than text-based passwords,
the existing user studies are very limited and there is n ot yet convincing evidence to
support this argument. Our preliminary analysis suggests that it is more difficult to
break graphical passwords using the traditional attack methods such as brute force
search, dictionary attack, or spyware. However, since there is not yet wide deployment
of graphical password systems, the vulnerabilities of graphical passwords are still not
fully understood.
Overall, the current graphical password techniques are still immature. Much more
research and user studies are needed for graphical password techniques to achieve
higher levels of maturity and usefulness.


References:

Websites:
http://www.passlogix.com/rd/maglev.php
www.howstuffworks.com/pass/login
www.passauthent.org/1095/.nsa/.htm

Books:

Susan Wiedenbeck “BASIC RESULT FOR PASSWORD
AUTHENTICATION” Asia Edition : McGraw Hill, 2010

AlexBrodskiy “GRAPHICAL PASSWORD
AUTHENTICATION SURVEY” Asia Edition : Pearson
Publication, 2011


Vshantaram

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (6)

Similar to Vshantaram

Similar to Vshantaram (20)

Vshantaram